Loading...
1/*
2 * cfg80211 MLME SAP interface
3 *
4 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
5 */
6
7#include <linux/kernel.h>
8#include <linux/module.h>
9#include <linux/netdevice.h>
10#include <linux/nl80211.h>
11#include <linux/slab.h>
12#include <linux/wireless.h>
13#include <net/cfg80211.h>
14#include <net/iw_handler.h>
15#include "core.h"
16#include "nl80211.h"
17
18void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
19{
20 struct wireless_dev *wdev = dev->ieee80211_ptr;
21 struct wiphy *wiphy = wdev->wiphy;
22 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
23 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
24 u8 *bssid = mgmt->bssid;
25 int i;
26 u16 status = le16_to_cpu(mgmt->u.auth.status_code);
27 bool done = false;
28
29 wdev_lock(wdev);
30
31 for (i = 0; i < MAX_AUTH_BSSES; i++) {
32 if (wdev->authtry_bsses[i] &&
33 memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
34 ETH_ALEN) == 0) {
35 if (status == WLAN_STATUS_SUCCESS) {
36 wdev->auth_bsses[i] = wdev->authtry_bsses[i];
37 } else {
38 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
39 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
40 }
41 wdev->authtry_bsses[i] = NULL;
42 done = true;
43 break;
44 }
45 }
46
47 if (done) {
48 nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
49 cfg80211_sme_rx_auth(dev, buf, len);
50 }
51
52 wdev_unlock(wdev);
53}
54EXPORT_SYMBOL(cfg80211_send_rx_auth);
55
56void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
57{
58 u16 status_code;
59 struct wireless_dev *wdev = dev->ieee80211_ptr;
60 struct wiphy *wiphy = wdev->wiphy;
61 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
62 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
63 u8 *ie = mgmt->u.assoc_resp.variable;
64 int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
65 struct cfg80211_internal_bss *bss = NULL;
66
67 wdev_lock(wdev);
68
69 status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
70
71 /*
72 * This is a bit of a hack, we don't notify userspace of
73 * a (re-)association reply if we tried to send a reassoc
74 * and got a reject -- we only try again with an assoc
75 * frame instead of reassoc.
76 */
77 if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
78 cfg80211_sme_failed_reassoc(wdev))
79 goto out;
80
81 nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
82
83 if (status_code == WLAN_STATUS_SUCCESS) {
84 for (i = 0; i < MAX_AUTH_BSSES; i++) {
85 if (!wdev->auth_bsses[i])
86 continue;
87 if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
88 ETH_ALEN) == 0) {
89 bss = wdev->auth_bsses[i];
90 wdev->auth_bsses[i] = NULL;
91 /* additional reference to drop hold */
92 cfg80211_ref_bss(bss);
93 break;
94 }
95 }
96
97 /*
98 * We might be coming here because the driver reported
99 * a successful association at the same time as the
100 * user requested a deauth. In that case, we will have
101 * removed the BSS from the auth_bsses list due to the
102 * deauth request when the assoc response makes it. If
103 * the two code paths acquire the lock the other way
104 * around, that's just the standard situation of a
105 * deauth being requested while connected.
106 */
107 if (!bss)
108 goto out;
109 } else if (wdev->conn) {
110 cfg80211_sme_failed_assoc(wdev);
111 /*
112 * do not call connect_result() now because the
113 * sme will schedule work that does it later.
114 */
115 goto out;
116 }
117
118 if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
119 /*
120 * This is for the userspace SME, the CONNECTING
121 * state will be changed to CONNECTED by
122 * __cfg80211_connect_result() below.
123 */
124 wdev->sme_state = CFG80211_SME_CONNECTING;
125 }
126
127 /* this consumes one bss reference (unless bss is NULL) */
128 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
129 status_code,
130 status_code == WLAN_STATUS_SUCCESS,
131 bss ? &bss->pub : NULL);
132 /* drop hold now, and also reference acquired above */
133 if (bss) {
134 cfg80211_unhold_bss(bss);
135 cfg80211_put_bss(&bss->pub);
136 }
137
138 out:
139 wdev_unlock(wdev);
140}
141EXPORT_SYMBOL(cfg80211_send_rx_assoc);
142
143void __cfg80211_send_deauth(struct net_device *dev,
144 const u8 *buf, size_t len)
145{
146 struct wireless_dev *wdev = dev->ieee80211_ptr;
147 struct wiphy *wiphy = wdev->wiphy;
148 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
149 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
150 const u8 *bssid = mgmt->bssid;
151 int i;
152 bool found = false, was_current = false;
153
154 ASSERT_WDEV_LOCK(wdev);
155
156 if (wdev->current_bss &&
157 memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
158 cfg80211_unhold_bss(wdev->current_bss);
159 cfg80211_put_bss(&wdev->current_bss->pub);
160 wdev->current_bss = NULL;
161 found = true;
162 was_current = true;
163 } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
164 if (wdev->auth_bsses[i] &&
165 memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
166 cfg80211_unhold_bss(wdev->auth_bsses[i]);
167 cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
168 wdev->auth_bsses[i] = NULL;
169 found = true;
170 break;
171 }
172 if (wdev->authtry_bsses[i] &&
173 memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
174 ETH_ALEN) == 0 &&
175 memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) == 0) {
176 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
177 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
178 wdev->authtry_bsses[i] = NULL;
179 found = true;
180 break;
181 }
182 }
183
184 if (!found)
185 return;
186
187 nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
188
189 if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
190 u16 reason_code;
191 bool from_ap;
192
193 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
194
195 from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
196 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
197 } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
198 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
199 WLAN_STATUS_UNSPECIFIED_FAILURE,
200 false, NULL);
201 }
202}
203EXPORT_SYMBOL(__cfg80211_send_deauth);
204
205void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
206{
207 struct wireless_dev *wdev = dev->ieee80211_ptr;
208
209 wdev_lock(wdev);
210 __cfg80211_send_deauth(dev, buf, len);
211 wdev_unlock(wdev);
212}
213EXPORT_SYMBOL(cfg80211_send_deauth);
214
215void __cfg80211_send_disassoc(struct net_device *dev,
216 const u8 *buf, size_t len)
217{
218 struct wireless_dev *wdev = dev->ieee80211_ptr;
219 struct wiphy *wiphy = wdev->wiphy;
220 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
221 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
222 const u8 *bssid = mgmt->bssid;
223 int i;
224 u16 reason_code;
225 bool from_ap;
226 bool done = false;
227
228 ASSERT_WDEV_LOCK(wdev);
229
230 nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
231
232 if (wdev->sme_state != CFG80211_SME_CONNECTED)
233 return;
234
235 if (wdev->current_bss &&
236 memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
237 for (i = 0; i < MAX_AUTH_BSSES; i++) {
238 if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
239 continue;
240 wdev->auth_bsses[i] = wdev->current_bss;
241 wdev->current_bss = NULL;
242 done = true;
243 cfg80211_sme_disassoc(dev, i);
244 break;
245 }
246 WARN_ON(!done);
247 } else
248 WARN_ON(1);
249
250
251 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
252
253 from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
254 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
255}
256EXPORT_SYMBOL(__cfg80211_send_disassoc);
257
258void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
259{
260 struct wireless_dev *wdev = dev->ieee80211_ptr;
261
262 wdev_lock(wdev);
263 __cfg80211_send_disassoc(dev, buf, len);
264 wdev_unlock(wdev);
265}
266EXPORT_SYMBOL(cfg80211_send_disassoc);
267
268void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
269 size_t len)
270{
271 struct wireless_dev *wdev = dev->ieee80211_ptr;
272 struct wiphy *wiphy = wdev->wiphy;
273 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
274
275 nl80211_send_unprot_deauth(rdev, dev, buf, len, GFP_ATOMIC);
276}
277EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
278
279void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
280 size_t len)
281{
282 struct wireless_dev *wdev = dev->ieee80211_ptr;
283 struct wiphy *wiphy = wdev->wiphy;
284 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
285
286 nl80211_send_unprot_disassoc(rdev, dev, buf, len, GFP_ATOMIC);
287}
288EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
289
290static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
291{
292 int i;
293 bool done = false;
294
295 ASSERT_WDEV_LOCK(wdev);
296
297 for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
298 if (wdev->authtry_bsses[i] &&
299 memcmp(wdev->authtry_bsses[i]->pub.bssid,
300 addr, ETH_ALEN) == 0) {
301 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
302 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
303 wdev->authtry_bsses[i] = NULL;
304 done = true;
305 break;
306 }
307 }
308
309 WARN_ON(!done);
310}
311
312void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
313{
314 __cfg80211_auth_remove(dev->ieee80211_ptr, addr);
315}
316EXPORT_SYMBOL(__cfg80211_auth_canceled);
317
318void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
319{
320 struct wireless_dev *wdev = dev->ieee80211_ptr;
321 struct wiphy *wiphy = wdev->wiphy;
322 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
323
324 wdev_lock(wdev);
325
326 nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
327 if (wdev->sme_state == CFG80211_SME_CONNECTING)
328 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
329 WLAN_STATUS_UNSPECIFIED_FAILURE,
330 false, NULL);
331
332 __cfg80211_auth_remove(wdev, addr);
333
334 wdev_unlock(wdev);
335}
336EXPORT_SYMBOL(cfg80211_send_auth_timeout);
337
338void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
339{
340 struct wireless_dev *wdev = dev->ieee80211_ptr;
341 struct wiphy *wiphy = wdev->wiphy;
342 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
343 int i;
344 bool done = false;
345
346 wdev_lock(wdev);
347
348 nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
349 if (wdev->sme_state == CFG80211_SME_CONNECTING)
350 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
351 WLAN_STATUS_UNSPECIFIED_FAILURE,
352 false, NULL);
353
354 for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
355 if (wdev->auth_bsses[i] &&
356 memcmp(wdev->auth_bsses[i]->pub.bssid,
357 addr, ETH_ALEN) == 0) {
358 cfg80211_unhold_bss(wdev->auth_bsses[i]);
359 cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
360 wdev->auth_bsses[i] = NULL;
361 done = true;
362 break;
363 }
364 }
365
366 WARN_ON(!done);
367
368 wdev_unlock(wdev);
369}
370EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
371
372void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
373 enum nl80211_key_type key_type, int key_id,
374 const u8 *tsc, gfp_t gfp)
375{
376 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
377 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
378#ifdef CONFIG_CFG80211_WEXT
379 union iwreq_data wrqu;
380 char *buf = kmalloc(128, gfp);
381
382 if (buf) {
383 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
384 "keyid=%d %scast addr=%pM)", key_id,
385 key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
386 addr);
387 memset(&wrqu, 0, sizeof(wrqu));
388 wrqu.data.length = strlen(buf);
389 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
390 kfree(buf);
391 }
392#endif
393
394 nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
395}
396EXPORT_SYMBOL(cfg80211_michael_mic_failure);
397
398/* some MLME handling for userspace SME */
399int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
400 struct net_device *dev,
401 struct ieee80211_channel *chan,
402 enum nl80211_auth_type auth_type,
403 const u8 *bssid,
404 const u8 *ssid, int ssid_len,
405 const u8 *ie, int ie_len,
406 const u8 *key, int key_len, int key_idx,
407 bool local_state_change)
408{
409 struct wireless_dev *wdev = dev->ieee80211_ptr;
410 struct cfg80211_auth_request req;
411 struct cfg80211_internal_bss *bss;
412 int i, err, slot = -1, nfree = 0;
413
414 ASSERT_WDEV_LOCK(wdev);
415
416 if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
417 if (!key || !key_len || key_idx < 0 || key_idx > 4)
418 return -EINVAL;
419
420 if (wdev->current_bss &&
421 memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
422 return -EALREADY;
423
424 for (i = 0; i < MAX_AUTH_BSSES; i++) {
425 if (wdev->authtry_bsses[i] &&
426 memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
427 ETH_ALEN) == 0)
428 return -EALREADY;
429 if (wdev->auth_bsses[i] &&
430 memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
431 ETH_ALEN) == 0)
432 return -EALREADY;
433 }
434
435 memset(&req, 0, sizeof(req));
436
437 req.local_state_change = local_state_change;
438 req.ie = ie;
439 req.ie_len = ie_len;
440 req.auth_type = auth_type;
441 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
442 WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
443 req.key = key;
444 req.key_len = key_len;
445 req.key_idx = key_idx;
446 if (!req.bss)
447 return -ENOENT;
448
449 bss = bss_from_pub(req.bss);
450
451 for (i = 0; i < MAX_AUTH_BSSES; i++) {
452 if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
453 slot = i;
454 nfree++;
455 }
456 }
457
458 /* we need one free slot for disassoc and one for this auth */
459 if (nfree < 2) {
460 err = -ENOSPC;
461 goto out;
462 }
463
464 if (local_state_change)
465 wdev->auth_bsses[slot] = bss;
466 else
467 wdev->authtry_bsses[slot] = bss;
468 cfg80211_hold_bss(bss);
469
470 err = rdev->ops->auth(&rdev->wiphy, dev, &req);
471 if (err) {
472 if (local_state_change)
473 wdev->auth_bsses[slot] = NULL;
474 else
475 wdev->authtry_bsses[slot] = NULL;
476 cfg80211_unhold_bss(bss);
477 }
478
479 out:
480 if (err)
481 cfg80211_put_bss(req.bss);
482 return err;
483}
484
485int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
486 struct net_device *dev, struct ieee80211_channel *chan,
487 enum nl80211_auth_type auth_type, const u8 *bssid,
488 const u8 *ssid, int ssid_len,
489 const u8 *ie, int ie_len,
490 const u8 *key, int key_len, int key_idx,
491 bool local_state_change)
492{
493 int err;
494
495 wdev_lock(dev->ieee80211_ptr);
496 err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
497 ssid, ssid_len, ie, ie_len,
498 key, key_len, key_idx, local_state_change);
499 wdev_unlock(dev->ieee80211_ptr);
500
501 return err;
502}
503
504int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
505 struct net_device *dev,
506 struct ieee80211_channel *chan,
507 const u8 *bssid, const u8 *prev_bssid,
508 const u8 *ssid, int ssid_len,
509 const u8 *ie, int ie_len, bool use_mfp,
510 struct cfg80211_crypto_settings *crypt)
511{
512 struct wireless_dev *wdev = dev->ieee80211_ptr;
513 struct cfg80211_assoc_request req;
514 struct cfg80211_internal_bss *bss;
515 int i, err, slot = -1;
516 bool was_connected = false;
517
518 ASSERT_WDEV_LOCK(wdev);
519
520 memset(&req, 0, sizeof(req));
521
522 if (wdev->current_bss && prev_bssid &&
523 memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
524 /*
525 * Trying to reassociate: Allow this to proceed and let the old
526 * association to be dropped when the new one is completed.
527 */
528 if (wdev->sme_state == CFG80211_SME_CONNECTED) {
529 was_connected = true;
530 wdev->sme_state = CFG80211_SME_CONNECTING;
531 }
532 } else if (wdev->current_bss)
533 return -EALREADY;
534
535 req.ie = ie;
536 req.ie_len = ie_len;
537 memcpy(&req.crypto, crypt, sizeof(req.crypto));
538 req.use_mfp = use_mfp;
539 req.prev_bssid = prev_bssid;
540 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
541 WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
542 if (!req.bss) {
543 if (was_connected)
544 wdev->sme_state = CFG80211_SME_CONNECTED;
545 return -ENOENT;
546 }
547
548 bss = bss_from_pub(req.bss);
549
550 for (i = 0; i < MAX_AUTH_BSSES; i++) {
551 if (bss == wdev->auth_bsses[i]) {
552 slot = i;
553 break;
554 }
555 }
556
557 if (slot < 0) {
558 err = -ENOTCONN;
559 goto out;
560 }
561
562 err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
563 out:
564 if (err && was_connected)
565 wdev->sme_state = CFG80211_SME_CONNECTED;
566 /* still a reference in wdev->auth_bsses[slot] */
567 cfg80211_put_bss(req.bss);
568 return err;
569}
570
571int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
572 struct net_device *dev,
573 struct ieee80211_channel *chan,
574 const u8 *bssid, const u8 *prev_bssid,
575 const u8 *ssid, int ssid_len,
576 const u8 *ie, int ie_len, bool use_mfp,
577 struct cfg80211_crypto_settings *crypt)
578{
579 struct wireless_dev *wdev = dev->ieee80211_ptr;
580 int err;
581
582 wdev_lock(wdev);
583 err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
584 ssid, ssid_len, ie, ie_len, use_mfp, crypt);
585 wdev_unlock(wdev);
586
587 return err;
588}
589
590int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
591 struct net_device *dev, const u8 *bssid,
592 const u8 *ie, int ie_len, u16 reason,
593 bool local_state_change)
594{
595 struct wireless_dev *wdev = dev->ieee80211_ptr;
596 struct cfg80211_deauth_request req;
597 int i;
598
599 ASSERT_WDEV_LOCK(wdev);
600
601 memset(&req, 0, sizeof(req));
602 req.reason_code = reason;
603 req.local_state_change = local_state_change;
604 req.ie = ie;
605 req.ie_len = ie_len;
606 if (wdev->current_bss &&
607 memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
608 req.bss = &wdev->current_bss->pub;
609 } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
610 if (wdev->auth_bsses[i] &&
611 memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
612 req.bss = &wdev->auth_bsses[i]->pub;
613 break;
614 }
615 if (wdev->authtry_bsses[i] &&
616 memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
617 req.bss = &wdev->authtry_bsses[i]->pub;
618 break;
619 }
620 }
621
622 if (!req.bss)
623 return -ENOTCONN;
624
625 return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
626}
627
628int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
629 struct net_device *dev, const u8 *bssid,
630 const u8 *ie, int ie_len, u16 reason,
631 bool local_state_change)
632{
633 struct wireless_dev *wdev = dev->ieee80211_ptr;
634 int err;
635
636 wdev_lock(wdev);
637 err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
638 local_state_change);
639 wdev_unlock(wdev);
640
641 return err;
642}
643
644static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
645 struct net_device *dev, const u8 *bssid,
646 const u8 *ie, int ie_len, u16 reason,
647 bool local_state_change)
648{
649 struct wireless_dev *wdev = dev->ieee80211_ptr;
650 struct cfg80211_disassoc_request req;
651
652 ASSERT_WDEV_LOCK(wdev);
653
654 if (wdev->sme_state != CFG80211_SME_CONNECTED)
655 return -ENOTCONN;
656
657 if (WARN_ON(!wdev->current_bss))
658 return -ENOTCONN;
659
660 memset(&req, 0, sizeof(req));
661 req.reason_code = reason;
662 req.local_state_change = local_state_change;
663 req.ie = ie;
664 req.ie_len = ie_len;
665 if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
666 req.bss = &wdev->current_bss->pub;
667 else
668 return -ENOTCONN;
669
670 return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
671}
672
673int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
674 struct net_device *dev, const u8 *bssid,
675 const u8 *ie, int ie_len, u16 reason,
676 bool local_state_change)
677{
678 struct wireless_dev *wdev = dev->ieee80211_ptr;
679 int err;
680
681 wdev_lock(wdev);
682 err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
683 local_state_change);
684 wdev_unlock(wdev);
685
686 return err;
687}
688
689void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
690 struct net_device *dev)
691{
692 struct wireless_dev *wdev = dev->ieee80211_ptr;
693 struct cfg80211_deauth_request req;
694 int i;
695
696 ASSERT_WDEV_LOCK(wdev);
697
698 if (!rdev->ops->deauth)
699 return;
700
701 memset(&req, 0, sizeof(req));
702 req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
703 req.ie = NULL;
704 req.ie_len = 0;
705
706 if (wdev->current_bss) {
707 req.bss = &wdev->current_bss->pub;
708 rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
709 if (wdev->current_bss) {
710 cfg80211_unhold_bss(wdev->current_bss);
711 cfg80211_put_bss(&wdev->current_bss->pub);
712 wdev->current_bss = NULL;
713 }
714 }
715
716 for (i = 0; i < MAX_AUTH_BSSES; i++) {
717 if (wdev->auth_bsses[i]) {
718 req.bss = &wdev->auth_bsses[i]->pub;
719 rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
720 if (wdev->auth_bsses[i]) {
721 cfg80211_unhold_bss(wdev->auth_bsses[i]);
722 cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
723 wdev->auth_bsses[i] = NULL;
724 }
725 }
726 if (wdev->authtry_bsses[i]) {
727 req.bss = &wdev->authtry_bsses[i]->pub;
728 rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
729 if (wdev->authtry_bsses[i]) {
730 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
731 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
732 wdev->authtry_bsses[i] = NULL;
733 }
734 }
735 }
736}
737
738void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
739 struct ieee80211_channel *chan,
740 enum nl80211_channel_type channel_type,
741 unsigned int duration, gfp_t gfp)
742{
743 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
744 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
745
746 nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
747 duration, gfp);
748}
749EXPORT_SYMBOL(cfg80211_ready_on_channel);
750
751void cfg80211_remain_on_channel_expired(struct net_device *dev,
752 u64 cookie,
753 struct ieee80211_channel *chan,
754 enum nl80211_channel_type channel_type,
755 gfp_t gfp)
756{
757 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
758 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
759
760 nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
761 channel_type, gfp);
762}
763EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
764
765void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
766 struct station_info *sinfo, gfp_t gfp)
767{
768 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
769 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
770
771 nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
772}
773EXPORT_SYMBOL(cfg80211_new_sta);
774
775void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
776{
777 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
778 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
779
780 nl80211_send_sta_del_event(rdev, dev, mac_addr, gfp);
781}
782EXPORT_SYMBOL(cfg80211_del_sta);
783
784struct cfg80211_mgmt_registration {
785 struct list_head list;
786
787 u32 nlpid;
788
789 int match_len;
790
791 __le16 frame_type;
792
793 u8 match[];
794};
795
796int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
797 u16 frame_type, const u8 *match_data,
798 int match_len)
799{
800 struct wiphy *wiphy = wdev->wiphy;
801 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
802 struct cfg80211_mgmt_registration *reg, *nreg;
803 int err = 0;
804 u16 mgmt_type;
805
806 if (!wdev->wiphy->mgmt_stypes)
807 return -EOPNOTSUPP;
808
809 if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
810 return -EINVAL;
811
812 if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
813 return -EINVAL;
814
815 mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
816 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
817 return -EINVAL;
818
819 nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
820 if (!nreg)
821 return -ENOMEM;
822
823 spin_lock_bh(&wdev->mgmt_registrations_lock);
824
825 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
826 int mlen = min(match_len, reg->match_len);
827
828 if (frame_type != le16_to_cpu(reg->frame_type))
829 continue;
830
831 if (memcmp(reg->match, match_data, mlen) == 0) {
832 err = -EALREADY;
833 break;
834 }
835 }
836
837 if (err) {
838 kfree(nreg);
839 goto out;
840 }
841
842 memcpy(nreg->match, match_data, match_len);
843 nreg->match_len = match_len;
844 nreg->nlpid = snd_pid;
845 nreg->frame_type = cpu_to_le16(frame_type);
846 list_add(&nreg->list, &wdev->mgmt_registrations);
847
848 if (rdev->ops->mgmt_frame_register)
849 rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
850 frame_type, true);
851
852 out:
853 spin_unlock_bh(&wdev->mgmt_registrations_lock);
854
855 return err;
856}
857
858void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid)
859{
860 struct wiphy *wiphy = wdev->wiphy;
861 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
862 struct cfg80211_mgmt_registration *reg, *tmp;
863
864 spin_lock_bh(&wdev->mgmt_registrations_lock);
865
866 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
867 if (reg->nlpid != nlpid)
868 continue;
869
870 if (rdev->ops->mgmt_frame_register) {
871 u16 frame_type = le16_to_cpu(reg->frame_type);
872
873 rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
874 frame_type, false);
875 }
876
877 list_del(®->list);
878 kfree(reg);
879 }
880
881 spin_unlock_bh(&wdev->mgmt_registrations_lock);
882}
883
884void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
885{
886 struct cfg80211_mgmt_registration *reg, *tmp;
887
888 spin_lock_bh(&wdev->mgmt_registrations_lock);
889
890 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
891 list_del(®->list);
892 kfree(reg);
893 }
894
895 spin_unlock_bh(&wdev->mgmt_registrations_lock);
896}
897
898int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
899 struct net_device *dev,
900 struct ieee80211_channel *chan, bool offchan,
901 enum nl80211_channel_type channel_type,
902 bool channel_type_valid, unsigned int wait,
903 const u8 *buf, size_t len, u64 *cookie)
904{
905 struct wireless_dev *wdev = dev->ieee80211_ptr;
906 const struct ieee80211_mgmt *mgmt;
907 u16 stype;
908
909 if (!wdev->wiphy->mgmt_stypes)
910 return -EOPNOTSUPP;
911
912 if (!rdev->ops->mgmt_tx)
913 return -EOPNOTSUPP;
914
915 if (len < 24 + 1)
916 return -EINVAL;
917
918 mgmt = (const struct ieee80211_mgmt *) buf;
919
920 if (!ieee80211_is_mgmt(mgmt->frame_control))
921 return -EINVAL;
922
923 stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
924 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
925 return -EINVAL;
926
927 if (ieee80211_is_action(mgmt->frame_control) &&
928 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
929 int err = 0;
930
931 wdev_lock(wdev);
932
933 switch (wdev->iftype) {
934 case NL80211_IFTYPE_ADHOC:
935 case NL80211_IFTYPE_STATION:
936 case NL80211_IFTYPE_P2P_CLIENT:
937 if (!wdev->current_bss) {
938 err = -ENOTCONN;
939 break;
940 }
941
942 if (memcmp(wdev->current_bss->pub.bssid,
943 mgmt->bssid, ETH_ALEN)) {
944 err = -ENOTCONN;
945 break;
946 }
947
948 /*
949 * check for IBSS DA must be done by driver as
950 * cfg80211 doesn't track the stations
951 */
952 if (wdev->iftype == NL80211_IFTYPE_ADHOC)
953 break;
954
955 /* for station, check that DA is the AP */
956 if (memcmp(wdev->current_bss->pub.bssid,
957 mgmt->da, ETH_ALEN)) {
958 err = -ENOTCONN;
959 break;
960 }
961 break;
962 case NL80211_IFTYPE_AP:
963 case NL80211_IFTYPE_P2P_GO:
964 case NL80211_IFTYPE_AP_VLAN:
965 if (memcmp(mgmt->bssid, dev->dev_addr, ETH_ALEN))
966 err = -EINVAL;
967 break;
968 case NL80211_IFTYPE_MESH_POINT:
969 if (memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN)) {
970 err = -EINVAL;
971 break;
972 }
973 /*
974 * check for mesh DA must be done by driver as
975 * cfg80211 doesn't track the stations
976 */
977 break;
978 default:
979 err = -EOPNOTSUPP;
980 break;
981 }
982 wdev_unlock(wdev);
983
984 if (err)
985 return err;
986 }
987
988 if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
989 return -EINVAL;
990
991 /* Transmit the Action frame as requested by user space */
992 return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, offchan,
993 channel_type, channel_type_valid,
994 wait, buf, len, cookie);
995}
996
997bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
998 size_t len, gfp_t gfp)
999{
1000 struct wireless_dev *wdev = dev->ieee80211_ptr;
1001 struct wiphy *wiphy = wdev->wiphy;
1002 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1003 struct cfg80211_mgmt_registration *reg;
1004 const struct ieee80211_txrx_stypes *stypes =
1005 &wiphy->mgmt_stypes[wdev->iftype];
1006 struct ieee80211_mgmt *mgmt = (void *)buf;
1007 const u8 *data;
1008 int data_len;
1009 bool result = false;
1010 __le16 ftype = mgmt->frame_control &
1011 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
1012 u16 stype;
1013
1014 stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
1015
1016 if (!(stypes->rx & BIT(stype)))
1017 return false;
1018
1019 data = buf + ieee80211_hdrlen(mgmt->frame_control);
1020 data_len = len - ieee80211_hdrlen(mgmt->frame_control);
1021
1022 spin_lock_bh(&wdev->mgmt_registrations_lock);
1023
1024 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
1025 if (reg->frame_type != ftype)
1026 continue;
1027
1028 if (reg->match_len > data_len)
1029 continue;
1030
1031 if (memcmp(reg->match, data, reg->match_len))
1032 continue;
1033
1034 /* found match! */
1035
1036 /* Indicate the received Action frame to user space */
1037 if (nl80211_send_mgmt(rdev, dev, reg->nlpid, freq,
1038 buf, len, gfp))
1039 continue;
1040
1041 result = true;
1042 break;
1043 }
1044
1045 spin_unlock_bh(&wdev->mgmt_registrations_lock);
1046
1047 return result;
1048}
1049EXPORT_SYMBOL(cfg80211_rx_mgmt);
1050
1051void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
1052 const u8 *buf, size_t len, bool ack, gfp_t gfp)
1053{
1054 struct wireless_dev *wdev = dev->ieee80211_ptr;
1055 struct wiphy *wiphy = wdev->wiphy;
1056 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1057
1058 /* Indicate TX status of the Action frame to user space */
1059 nl80211_send_mgmt_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
1060}
1061EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
1062
1063void cfg80211_cqm_rssi_notify(struct net_device *dev,
1064 enum nl80211_cqm_rssi_threshold_event rssi_event,
1065 gfp_t gfp)
1066{
1067 struct wireless_dev *wdev = dev->ieee80211_ptr;
1068 struct wiphy *wiphy = wdev->wiphy;
1069 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1070
1071 /* Indicate roaming trigger event to user space */
1072 nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
1073}
1074EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
1075
1076void cfg80211_cqm_pktloss_notify(struct net_device *dev,
1077 const u8 *peer, u32 num_packets, gfp_t gfp)
1078{
1079 struct wireless_dev *wdev = dev->ieee80211_ptr;
1080 struct wiphy *wiphy = wdev->wiphy;
1081 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1082
1083 /* Indicate roaming trigger event to user space */
1084 nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
1085}
1086EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
1087
1088void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
1089 const u8 *replay_ctr, gfp_t gfp)
1090{
1091 struct wireless_dev *wdev = dev->ieee80211_ptr;
1092 struct wiphy *wiphy = wdev->wiphy;
1093 struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1094
1095 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
1096}
1097EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * cfg80211 MLME SAP interface
4 *
5 * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
6 * Copyright (c) 2015 Intel Deutschland GmbH
7 */
8
9#include <linux/kernel.h>
10#include <linux/module.h>
11#include <linux/etherdevice.h>
12#include <linux/netdevice.h>
13#include <linux/nl80211.h>
14#include <linux/slab.h>
15#include <linux/wireless.h>
16#include <net/cfg80211.h>
17#include <net/iw_handler.h>
18#include "core.h"
19#include "nl80211.h"
20#include "rdev-ops.h"
21
22
23void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
24 const u8 *buf, size_t len, int uapsd_queues,
25 const u8 *req_ies, size_t req_ies_len)
26{
27 struct wireless_dev *wdev = dev->ieee80211_ptr;
28 struct wiphy *wiphy = wdev->wiphy;
29 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
30 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
31 struct cfg80211_connect_resp_params cr;
32
33 memset(&cr, 0, sizeof(cr));
34 cr.status = (int)le16_to_cpu(mgmt->u.assoc_resp.status_code);
35 cr.bssid = mgmt->bssid;
36 cr.bss = bss;
37 cr.req_ie = req_ies;
38 cr.req_ie_len = req_ies_len;
39 cr.resp_ie = mgmt->u.assoc_resp.variable;
40 cr.resp_ie_len =
41 len - offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
42 cr.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED;
43
44 trace_cfg80211_send_rx_assoc(dev, bss);
45
46 /*
47 * This is a bit of a hack, we don't notify userspace of
48 * a (re-)association reply if we tried to send a reassoc
49 * and got a reject -- we only try again with an assoc
50 * frame instead of reassoc.
51 */
52 if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) {
53 cfg80211_unhold_bss(bss_from_pub(bss));
54 cfg80211_put_bss(wiphy, bss);
55 return;
56 }
57
58 nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL, uapsd_queues,
59 req_ies, req_ies_len);
60 /* update current_bss etc., consumes the bss reference */
61 __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
62}
63EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
64
65static void cfg80211_process_auth(struct wireless_dev *wdev,
66 const u8 *buf, size_t len)
67{
68 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
69
70 nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
71 cfg80211_sme_rx_auth(wdev, buf, len);
72}
73
74static void cfg80211_process_deauth(struct wireless_dev *wdev,
75 const u8 *buf, size_t len)
76{
77 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
78 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
79 const u8 *bssid = mgmt->bssid;
80 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
81 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
82
83 nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
84
85 if (!wdev->current_bss ||
86 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
87 return;
88
89 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
90 cfg80211_sme_deauth(wdev);
91}
92
93static void cfg80211_process_disassoc(struct wireless_dev *wdev,
94 const u8 *buf, size_t len)
95{
96 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
97 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
98 const u8 *bssid = mgmt->bssid;
99 u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
100 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
101
102 nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
103
104 if (WARN_ON(!wdev->current_bss ||
105 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
106 return;
107
108 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
109 cfg80211_sme_disassoc(wdev);
110}
111
112void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
113{
114 struct wireless_dev *wdev = dev->ieee80211_ptr;
115 struct ieee80211_mgmt *mgmt = (void *)buf;
116
117 ASSERT_WDEV_LOCK(wdev);
118
119 trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
120
121 if (WARN_ON(len < 2))
122 return;
123
124 if (ieee80211_is_auth(mgmt->frame_control))
125 cfg80211_process_auth(wdev, buf, len);
126 else if (ieee80211_is_deauth(mgmt->frame_control))
127 cfg80211_process_deauth(wdev, buf, len);
128 else if (ieee80211_is_disassoc(mgmt->frame_control))
129 cfg80211_process_disassoc(wdev, buf, len);
130}
131EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
132
133void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
134{
135 struct wireless_dev *wdev = dev->ieee80211_ptr;
136 struct wiphy *wiphy = wdev->wiphy;
137 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
138
139 trace_cfg80211_send_auth_timeout(dev, addr);
140
141 nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
142 cfg80211_sme_auth_timeout(wdev);
143}
144EXPORT_SYMBOL(cfg80211_auth_timeout);
145
146void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
147{
148 struct wireless_dev *wdev = dev->ieee80211_ptr;
149 struct wiphy *wiphy = wdev->wiphy;
150 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
151
152 trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
153
154 nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
155 cfg80211_sme_assoc_timeout(wdev);
156
157 cfg80211_unhold_bss(bss_from_pub(bss));
158 cfg80211_put_bss(wiphy, bss);
159}
160EXPORT_SYMBOL(cfg80211_assoc_timeout);
161
162void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
163{
164 struct wireless_dev *wdev = dev->ieee80211_ptr;
165 struct wiphy *wiphy = wdev->wiphy;
166
167 cfg80211_sme_abandon_assoc(wdev);
168
169 cfg80211_unhold_bss(bss_from_pub(bss));
170 cfg80211_put_bss(wiphy, bss);
171}
172EXPORT_SYMBOL(cfg80211_abandon_assoc);
173
174void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
175{
176 struct wireless_dev *wdev = dev->ieee80211_ptr;
177 struct ieee80211_mgmt *mgmt = (void *)buf;
178
179 ASSERT_WDEV_LOCK(wdev);
180
181 trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
182
183 if (WARN_ON(len < 2))
184 return;
185
186 if (ieee80211_is_deauth(mgmt->frame_control))
187 cfg80211_process_deauth(wdev, buf, len);
188 else
189 cfg80211_process_disassoc(wdev, buf, len);
190}
191EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
192
193void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
194 enum nl80211_key_type key_type, int key_id,
195 const u8 *tsc, gfp_t gfp)
196{
197 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
198 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
199#ifdef CONFIG_CFG80211_WEXT
200 union iwreq_data wrqu;
201 char *buf = kmalloc(128, gfp);
202
203 if (buf) {
204 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
205 "keyid=%d %scast addr=%pM)", key_id,
206 key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
207 addr);
208 memset(&wrqu, 0, sizeof(wrqu));
209 wrqu.data.length = strlen(buf);
210 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
211 kfree(buf);
212 }
213#endif
214
215 trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
216 nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
217}
218EXPORT_SYMBOL(cfg80211_michael_mic_failure);
219
220/* some MLME handling for userspace SME */
221int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
222 struct net_device *dev,
223 struct ieee80211_channel *chan,
224 enum nl80211_auth_type auth_type,
225 const u8 *bssid,
226 const u8 *ssid, int ssid_len,
227 const u8 *ie, int ie_len,
228 const u8 *key, int key_len, int key_idx,
229 const u8 *auth_data, int auth_data_len)
230{
231 struct wireless_dev *wdev = dev->ieee80211_ptr;
232 struct cfg80211_auth_request req = {
233 .ie = ie,
234 .ie_len = ie_len,
235 .auth_data = auth_data,
236 .auth_data_len = auth_data_len,
237 .auth_type = auth_type,
238 .key = key,
239 .key_len = key_len,
240 .key_idx = key_idx,
241 };
242 int err;
243
244 ASSERT_WDEV_LOCK(wdev);
245
246 if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
247 if (!key || !key_len || key_idx < 0 || key_idx > 3)
248 return -EINVAL;
249
250 if (wdev->current_bss &&
251 ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
252 return -EALREADY;
253
254 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
255 IEEE80211_BSS_TYPE_ESS,
256 IEEE80211_PRIVACY_ANY);
257 if (!req.bss)
258 return -ENOENT;
259
260 err = rdev_auth(rdev, dev, &req);
261
262 cfg80211_put_bss(&rdev->wiphy, req.bss);
263 return err;
264}
265
266/* Do a logical ht_capa &= ht_capa_mask. */
267void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
268 const struct ieee80211_ht_cap *ht_capa_mask)
269{
270 int i;
271 u8 *p1, *p2;
272 if (!ht_capa_mask) {
273 memset(ht_capa, 0, sizeof(*ht_capa));
274 return;
275 }
276
277 p1 = (u8*)(ht_capa);
278 p2 = (u8*)(ht_capa_mask);
279 for (i = 0; i < sizeof(*ht_capa); i++)
280 p1[i] &= p2[i];
281}
282
283/* Do a logical vht_capa &= vht_capa_mask. */
284void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
285 const struct ieee80211_vht_cap *vht_capa_mask)
286{
287 int i;
288 u8 *p1, *p2;
289 if (!vht_capa_mask) {
290 memset(vht_capa, 0, sizeof(*vht_capa));
291 return;
292 }
293
294 p1 = (u8*)(vht_capa);
295 p2 = (u8*)(vht_capa_mask);
296 for (i = 0; i < sizeof(*vht_capa); i++)
297 p1[i] &= p2[i];
298}
299
300int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
301 struct net_device *dev,
302 struct ieee80211_channel *chan,
303 const u8 *bssid,
304 const u8 *ssid, int ssid_len,
305 struct cfg80211_assoc_request *req)
306{
307 struct wireless_dev *wdev = dev->ieee80211_ptr;
308 int err;
309
310 ASSERT_WDEV_LOCK(wdev);
311
312 if (wdev->current_bss &&
313 (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
314 req->prev_bssid)))
315 return -EALREADY;
316
317 cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
318 rdev->wiphy.ht_capa_mod_mask);
319 cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
320 rdev->wiphy.vht_capa_mod_mask);
321
322 req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
323 IEEE80211_BSS_TYPE_ESS,
324 IEEE80211_PRIVACY_ANY);
325 if (!req->bss)
326 return -ENOENT;
327
328 err = rdev_assoc(rdev, dev, req);
329 if (!err)
330 cfg80211_hold_bss(bss_from_pub(req->bss));
331 else
332 cfg80211_put_bss(&rdev->wiphy, req->bss);
333
334 return err;
335}
336
337int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
338 struct net_device *dev, const u8 *bssid,
339 const u8 *ie, int ie_len, u16 reason,
340 bool local_state_change)
341{
342 struct wireless_dev *wdev = dev->ieee80211_ptr;
343 struct cfg80211_deauth_request req = {
344 .bssid = bssid,
345 .reason_code = reason,
346 .ie = ie,
347 .ie_len = ie_len,
348 .local_state_change = local_state_change,
349 };
350
351 ASSERT_WDEV_LOCK(wdev);
352
353 if (local_state_change &&
354 (!wdev->current_bss ||
355 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
356 return 0;
357
358 if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
359 (wdev->current_bss &&
360 ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
361 wdev->conn_owner_nlportid = 0;
362
363 return rdev_deauth(rdev, dev, &req);
364}
365
366int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
367 struct net_device *dev, const u8 *bssid,
368 const u8 *ie, int ie_len, u16 reason,
369 bool local_state_change)
370{
371 struct wireless_dev *wdev = dev->ieee80211_ptr;
372 struct cfg80211_disassoc_request req = {
373 .reason_code = reason,
374 .local_state_change = local_state_change,
375 .ie = ie,
376 .ie_len = ie_len,
377 };
378 int err;
379
380 ASSERT_WDEV_LOCK(wdev);
381
382 if (!wdev->current_bss)
383 return -ENOTCONN;
384
385 if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
386 req.bss = &wdev->current_bss->pub;
387 else
388 return -ENOTCONN;
389
390 err = rdev_disassoc(rdev, dev, &req);
391 if (err)
392 return err;
393
394 /* driver should have reported the disassoc */
395 WARN_ON(wdev->current_bss);
396 return 0;
397}
398
399void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
400 struct net_device *dev)
401{
402 struct wireless_dev *wdev = dev->ieee80211_ptr;
403 u8 bssid[ETH_ALEN];
404
405 ASSERT_WDEV_LOCK(wdev);
406
407 if (!rdev->ops->deauth)
408 return;
409
410 if (!wdev->current_bss)
411 return;
412
413 memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
414 cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
415 WLAN_REASON_DEAUTH_LEAVING, false);
416}
417
418struct cfg80211_mgmt_registration {
419 struct list_head list;
420 struct wireless_dev *wdev;
421
422 u32 nlportid;
423
424 int match_len;
425
426 __le16 frame_type;
427
428 u8 match[];
429};
430
431static void
432cfg80211_process_mlme_unregistrations(struct cfg80211_registered_device *rdev)
433{
434 struct cfg80211_mgmt_registration *reg;
435
436 ASSERT_RTNL();
437
438 spin_lock_bh(&rdev->mlme_unreg_lock);
439 while ((reg = list_first_entry_or_null(&rdev->mlme_unreg,
440 struct cfg80211_mgmt_registration,
441 list))) {
442 list_del(®->list);
443 spin_unlock_bh(&rdev->mlme_unreg_lock);
444
445 if (rdev->ops->mgmt_frame_register) {
446 u16 frame_type = le16_to_cpu(reg->frame_type);
447
448 rdev_mgmt_frame_register(rdev, reg->wdev,
449 frame_type, false);
450 }
451
452 kfree(reg);
453
454 spin_lock_bh(&rdev->mlme_unreg_lock);
455 }
456 spin_unlock_bh(&rdev->mlme_unreg_lock);
457}
458
459void cfg80211_mlme_unreg_wk(struct work_struct *wk)
460{
461 struct cfg80211_registered_device *rdev;
462
463 rdev = container_of(wk, struct cfg80211_registered_device,
464 mlme_unreg_wk);
465
466 rtnl_lock();
467 cfg80211_process_mlme_unregistrations(rdev);
468 rtnl_unlock();
469}
470
471int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
472 u16 frame_type, const u8 *match_data,
473 int match_len)
474{
475 struct wiphy *wiphy = wdev->wiphy;
476 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
477 struct cfg80211_mgmt_registration *reg, *nreg;
478 int err = 0;
479 u16 mgmt_type;
480
481 if (!wdev->wiphy->mgmt_stypes)
482 return -EOPNOTSUPP;
483
484 if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
485 return -EINVAL;
486
487 if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
488 return -EINVAL;
489
490 mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
491 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
492 return -EINVAL;
493
494 nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
495 if (!nreg)
496 return -ENOMEM;
497
498 spin_lock_bh(&wdev->mgmt_registrations_lock);
499
500 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
501 int mlen = min(match_len, reg->match_len);
502
503 if (frame_type != le16_to_cpu(reg->frame_type))
504 continue;
505
506 if (memcmp(reg->match, match_data, mlen) == 0) {
507 err = -EALREADY;
508 break;
509 }
510 }
511
512 if (err) {
513 kfree(nreg);
514 goto out;
515 }
516
517 memcpy(nreg->match, match_data, match_len);
518 nreg->match_len = match_len;
519 nreg->nlportid = snd_portid;
520 nreg->frame_type = cpu_to_le16(frame_type);
521 nreg->wdev = wdev;
522 list_add(&nreg->list, &wdev->mgmt_registrations);
523 spin_unlock_bh(&wdev->mgmt_registrations_lock);
524
525 /* process all unregistrations to avoid driver confusion */
526 cfg80211_process_mlme_unregistrations(rdev);
527
528 if (rdev->ops->mgmt_frame_register)
529 rdev_mgmt_frame_register(rdev, wdev, frame_type, true);
530
531 return 0;
532
533 out:
534 spin_unlock_bh(&wdev->mgmt_registrations_lock);
535
536 return err;
537}
538
539void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
540{
541 struct wiphy *wiphy = wdev->wiphy;
542 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
543 struct cfg80211_mgmt_registration *reg, *tmp;
544
545 spin_lock_bh(&wdev->mgmt_registrations_lock);
546
547 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
548 if (reg->nlportid != nlportid)
549 continue;
550
551 list_del(®->list);
552 spin_lock(&rdev->mlme_unreg_lock);
553 list_add_tail(®->list, &rdev->mlme_unreg);
554 spin_unlock(&rdev->mlme_unreg_lock);
555
556 schedule_work(&rdev->mlme_unreg_wk);
557 }
558
559 spin_unlock_bh(&wdev->mgmt_registrations_lock);
560
561 if (nlportid && rdev->crit_proto_nlportid == nlportid) {
562 rdev->crit_proto_nlportid = 0;
563 rdev_crit_proto_stop(rdev, wdev);
564 }
565
566 if (nlportid == wdev->ap_unexpected_nlportid)
567 wdev->ap_unexpected_nlportid = 0;
568}
569
570void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
571{
572 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
573
574 spin_lock_bh(&wdev->mgmt_registrations_lock);
575 spin_lock(&rdev->mlme_unreg_lock);
576 list_splice_tail_init(&wdev->mgmt_registrations, &rdev->mlme_unreg);
577 spin_unlock(&rdev->mlme_unreg_lock);
578 spin_unlock_bh(&wdev->mgmt_registrations_lock);
579
580 cfg80211_process_mlme_unregistrations(rdev);
581}
582
583int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
584 struct wireless_dev *wdev,
585 struct cfg80211_mgmt_tx_params *params, u64 *cookie)
586{
587 const struct ieee80211_mgmt *mgmt;
588 u16 stype;
589
590 if (!wdev->wiphy->mgmt_stypes)
591 return -EOPNOTSUPP;
592
593 if (!rdev->ops->mgmt_tx)
594 return -EOPNOTSUPP;
595
596 if (params->len < 24 + 1)
597 return -EINVAL;
598
599 mgmt = (const struct ieee80211_mgmt *)params->buf;
600
601 if (!ieee80211_is_mgmt(mgmt->frame_control))
602 return -EINVAL;
603
604 stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
605 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
606 return -EINVAL;
607
608 if (ieee80211_is_action(mgmt->frame_control) &&
609 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
610 int err = 0;
611
612 wdev_lock(wdev);
613
614 switch (wdev->iftype) {
615 case NL80211_IFTYPE_ADHOC:
616 case NL80211_IFTYPE_STATION:
617 case NL80211_IFTYPE_P2P_CLIENT:
618 if (!wdev->current_bss) {
619 err = -ENOTCONN;
620 break;
621 }
622
623 if (!ether_addr_equal(wdev->current_bss->pub.bssid,
624 mgmt->bssid)) {
625 err = -ENOTCONN;
626 break;
627 }
628
629 /*
630 * check for IBSS DA must be done by driver as
631 * cfg80211 doesn't track the stations
632 */
633 if (wdev->iftype == NL80211_IFTYPE_ADHOC)
634 break;
635
636 /* for station, check that DA is the AP */
637 if (!ether_addr_equal(wdev->current_bss->pub.bssid,
638 mgmt->da)) {
639 err = -ENOTCONN;
640 break;
641 }
642 break;
643 case NL80211_IFTYPE_AP:
644 case NL80211_IFTYPE_P2P_GO:
645 case NL80211_IFTYPE_AP_VLAN:
646 if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
647 err = -EINVAL;
648 break;
649 case NL80211_IFTYPE_MESH_POINT:
650 if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
651 err = -EINVAL;
652 break;
653 }
654 /*
655 * check for mesh DA must be done by driver as
656 * cfg80211 doesn't track the stations
657 */
658 break;
659 case NL80211_IFTYPE_P2P_DEVICE:
660 /*
661 * fall through, P2P device only supports
662 * public action frames
663 */
664 case NL80211_IFTYPE_NAN:
665 default:
666 err = -EOPNOTSUPP;
667 break;
668 }
669 wdev_unlock(wdev);
670
671 if (err)
672 return err;
673 }
674
675 if (!ether_addr_equal(mgmt->sa, wdev_address(wdev))) {
676 /* Allow random TA to be used with Public Action frames if the
677 * driver has indicated support for this. Otherwise, only allow
678 * the local address to be used.
679 */
680 if (!ieee80211_is_action(mgmt->frame_control) ||
681 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
682 return -EINVAL;
683 if (!wdev->current_bss &&
684 !wiphy_ext_feature_isset(
685 &rdev->wiphy,
686 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
687 return -EINVAL;
688 if (wdev->current_bss &&
689 !wiphy_ext_feature_isset(
690 &rdev->wiphy,
691 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
692 return -EINVAL;
693 }
694
695 /* Transmit the Action frame as requested by user space */
696 return rdev_mgmt_tx(rdev, wdev, params, cookie);
697}
698
699bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
700 const u8 *buf, size_t len, u32 flags)
701{
702 struct wiphy *wiphy = wdev->wiphy;
703 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
704 struct cfg80211_mgmt_registration *reg;
705 const struct ieee80211_txrx_stypes *stypes =
706 &wiphy->mgmt_stypes[wdev->iftype];
707 struct ieee80211_mgmt *mgmt = (void *)buf;
708 const u8 *data;
709 int data_len;
710 bool result = false;
711 __le16 ftype = mgmt->frame_control &
712 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
713 u16 stype;
714
715 trace_cfg80211_rx_mgmt(wdev, freq, sig_dbm);
716 stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
717
718 if (!(stypes->rx & BIT(stype))) {
719 trace_cfg80211_return_bool(false);
720 return false;
721 }
722
723 data = buf + ieee80211_hdrlen(mgmt->frame_control);
724 data_len = len - ieee80211_hdrlen(mgmt->frame_control);
725
726 spin_lock_bh(&wdev->mgmt_registrations_lock);
727
728 list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
729 if (reg->frame_type != ftype)
730 continue;
731
732 if (reg->match_len > data_len)
733 continue;
734
735 if (memcmp(reg->match, data, reg->match_len))
736 continue;
737
738 /* found match! */
739
740 /* Indicate the received Action frame to user space */
741 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
742 freq, sig_dbm,
743 buf, len, flags, GFP_ATOMIC))
744 continue;
745
746 result = true;
747 break;
748 }
749
750 spin_unlock_bh(&wdev->mgmt_registrations_lock);
751
752 trace_cfg80211_return_bool(result);
753 return result;
754}
755EXPORT_SYMBOL(cfg80211_rx_mgmt);
756
757void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
758{
759 cancel_delayed_work(&rdev->dfs_update_channels_wk);
760 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
761}
762
763void cfg80211_dfs_channels_update_work(struct work_struct *work)
764{
765 struct delayed_work *delayed_work = to_delayed_work(work);
766 struct cfg80211_registered_device *rdev;
767 struct cfg80211_chan_def chandef;
768 struct ieee80211_supported_band *sband;
769 struct ieee80211_channel *c;
770 struct wiphy *wiphy;
771 bool check_again = false;
772 unsigned long timeout, next_time = 0;
773 unsigned long time_dfs_update;
774 enum nl80211_radar_event radar_event;
775 int bandid, i;
776
777 rdev = container_of(delayed_work, struct cfg80211_registered_device,
778 dfs_update_channels_wk);
779 wiphy = &rdev->wiphy;
780
781 rtnl_lock();
782 for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
783 sband = wiphy->bands[bandid];
784 if (!sband)
785 continue;
786
787 for (i = 0; i < sband->n_channels; i++) {
788 c = &sband->channels[i];
789
790 if (!(c->flags & IEEE80211_CHAN_RADAR))
791 continue;
792
793 if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
794 c->dfs_state != NL80211_DFS_AVAILABLE)
795 continue;
796
797 if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
798 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
799 radar_event = NL80211_RADAR_NOP_FINISHED;
800 } else {
801 if (regulatory_pre_cac_allowed(wiphy) ||
802 cfg80211_any_wiphy_oper_chan(wiphy, c))
803 continue;
804
805 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
806 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
807 }
808
809 timeout = c->dfs_state_entered +
810 msecs_to_jiffies(time_dfs_update);
811
812 if (time_after_eq(jiffies, timeout)) {
813 c->dfs_state = NL80211_DFS_USABLE;
814 c->dfs_state_entered = jiffies;
815
816 cfg80211_chandef_create(&chandef, c,
817 NL80211_CHAN_NO_HT);
818
819 nl80211_radar_notify(rdev, &chandef,
820 radar_event, NULL,
821 GFP_ATOMIC);
822
823 regulatory_propagate_dfs_state(wiphy, &chandef,
824 c->dfs_state,
825 radar_event);
826 continue;
827 }
828
829 if (!check_again)
830 next_time = timeout - jiffies;
831 else
832 next_time = min(next_time, timeout - jiffies);
833 check_again = true;
834 }
835 }
836 rtnl_unlock();
837
838 /* reschedule if there are other channels waiting to be cleared again */
839 if (check_again)
840 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
841 next_time);
842}
843
844
845void cfg80211_radar_event(struct wiphy *wiphy,
846 struct cfg80211_chan_def *chandef,
847 gfp_t gfp)
848{
849 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
850
851 trace_cfg80211_radar_event(wiphy, chandef);
852
853 /* only set the chandef supplied channel to unavailable, in
854 * case the radar is detected on only one of multiple channels
855 * spanned by the chandef.
856 */
857 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
858
859 cfg80211_sched_dfs_chan_update(rdev);
860
861 nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
862
863 memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
864 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
865}
866EXPORT_SYMBOL(cfg80211_radar_event);
867
868void cfg80211_cac_event(struct net_device *netdev,
869 const struct cfg80211_chan_def *chandef,
870 enum nl80211_radar_event event, gfp_t gfp)
871{
872 struct wireless_dev *wdev = netdev->ieee80211_ptr;
873 struct wiphy *wiphy = wdev->wiphy;
874 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
875 unsigned long timeout;
876
877 trace_cfg80211_cac_event(netdev, event);
878
879 if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
880 return;
881
882 if (WARN_ON(!wdev->chandef.chan))
883 return;
884
885 switch (event) {
886 case NL80211_RADAR_CAC_FINISHED:
887 timeout = wdev->cac_start_time +
888 msecs_to_jiffies(wdev->cac_time_ms);
889 WARN_ON(!time_after_eq(jiffies, timeout));
890 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
891 memcpy(&rdev->cac_done_chandef, chandef,
892 sizeof(struct cfg80211_chan_def));
893 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
894 cfg80211_sched_dfs_chan_update(rdev);
895 /* fall through */
896 case NL80211_RADAR_CAC_ABORTED:
897 wdev->cac_started = false;
898 break;
899 case NL80211_RADAR_CAC_STARTED:
900 wdev->cac_started = true;
901 break;
902 default:
903 WARN_ON(1);
904 return;
905 }
906
907 nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
908}
909EXPORT_SYMBOL(cfg80211_cac_event);